how to prevent xss attack on angular applications

Question

I have this script in my response <img src=x onerror="alert('attack')" and in my .ts file i'm doing this document.getElementById("help").innerHTML=this.help; and it is executing in frontend and giving alert .. suggest how to stop this using content-security-policy as but no use.. any suggestions? please help

Answer 1

For the onerror event attribute you'll need to rewrite using an event listener instead, preferably in a separate js file and not inline.

If it is unformatted text you aim to insert with innerHTML you should use textContent method instead as it is XSS safe. Another option is also to use DOMPurify to make it XSS safe.